If you use the Bank Statement Reconciliation feature (available to ClassKasa Premium subscribers), you may upload bank statement files (PDF or images) for automated transaction extraction. The following describes how we process this data:
- Uploaded documents: bank statement files (PDF or image format) containing transaction details, account holder names, IBANs, account numbers, transaction descriptions, and amounts.
- Extracted transaction data: transaction descriptions, amounts, dates, and sender/recipient names parsed from the uploaded document by AI analysis.
- Bank statements may contain personal data (PII) including sender names, IBANs, account numbers, and transaction descriptions that reference individuals.
Lawful basis: Art. 6(1)(b) GDPR - processing is necessary for the performance of the contract (your ClassKasa Premium subscription). You initiate each scan by uploading a document and explicitly approving extracted results before any payment records are updated.
AI sub-processor: Uploaded documents are sent to Anthropic, PBC (San Francisco, USA) via its API for transaction extraction using the Claude language model. Anthropic processes the data solely to return results to ClassKasa and does not use API inputs to train its models. Transfer basis: Standard Contractual Clauses (SCCs). See the Sub-processors section for details.
Temporary file storage: Uploaded files are temporarily stored in Netlify Blobs (EU region) during processing. Original files are deleted immediately after AI analysis is complete. ClassKasa does not retain copies of your uploaded bank statements.
Data retention: Original uploaded files are deleted immediately after processing. Extracted transaction metadata (descriptions, amounts, dates, matched payment records) is retained as part of your class audit trail for the lifetime of the collection. You may request erasure of extracted data by contacting tomek@classkasa.com.
Your rights: You have the right to access, rectify, or request erasure of AI-extracted transaction data under Articles 15-17 GDPR. You may also object to AI processing under Art. 21 GDPR. Because the treasurer must explicitly approve all AI-suggested matches before records are updated, no automated decision-making within the meaning of Art. 22 GDPR takes place.